1. Field of the Invention
The present invention relates to a method for authentification of access authorization in a communication network wherein a preliminary, cancellable charging is charged to a caller on the network should the caller be unable to provide proper authentification of access authorization pursuant to predetermined criteria.
2. Description of the Prior Art
Authentification methods which check access authorization of a caller for a communication service, and which subsequently assign charges to the caller, are usually employed for some communication services that, for example are performed with the assistance of an intelligent network. Such network may include, for example, virtual card calling, universal personal telecommunication, remote access to virtual private network and multimedia services.
Such authentification methods are usually based on the input of a user identification (for example, a card number) and, potentially, an additional personal identification number (PIN). This authentification date must be kept secret from the user. However, such authentification methods can offer only limited security. Indeed valid authentification data can be fundamentally identified by testing a greater plurality of data. It can then be fraudulently used, for example, in order to implement communication processes at the expense of another person.
Acceptance problems arise when this misuse (illegal use) is to be made more difficult by employing numbers having many digits because extremely long inputs are then necessary for normal use (legal use).
Making misuse more difficult could also be fundamentally effected by charging a fee for unsuccessful authentification procedures. These charges, however, could not occur at the expense of the user since this user has not yet been identified at the time of unsuccessful authentification procedures. A charge instead at the expense of the terminal employed, on the other hand, is undesirable for the legal use of these services because it is contrary to the billing principle of these services. According to this billing principle, the terminal employed should remain free of charge because it can belong to a third party which is provided these services.
The consequence of these circumstances is that, when controlled, by a PC, for example, thousands of authentification attempts can be fraudulently automatically implemented (with prospects of success) without the fraudulent caller (illegal user) incurring charges therefor. The misuse can, thus, be commercially exercised.
Yet another instance of misuse is made easier due to the fact that unsuccessful authentification procedures are free of charge. For security reasons, access to the service is usually blocked for a user when a predetermined number of PIN entry errors is exceeded under the user's identification. Malefactors can use this in order to intentionally block access to services for other persons--and without incurring any charges.